In today’s world of vast data and cutting-edge technology, Geographic Information Systems (GIS) have become integral in mapping, analyzing, and visualizing geographical and spatial data. However, with the increasing reliance on location-based data comes an undeniable challenge in protecting individuals’ privacy while maximizing the potential of geospatial technologies. The interplay between GIS and data protection has never been more critical, as the integration of geographic data with personal information raises significant privacy concerns.
Generally, geographical information systems do not always provide the ability to identify individuals. As such, geospatial information will not usually fall within the scope of privacy and data protection. However, the versatility of geographical information whereby one data set can be used for various applications leaves it open for misuse. Where said data is about individuals or allows for the identification of individuals, it automatically becomes personal data. The increased scope and quality of data in geospatial information has further blurred the divide hence the intricate relationship between geospatial information systems and data protection.
The Constitution of Kenya 2010 guarantees the right to privacy as a fundamental right in Article 31. To safeguard the privacy, the Data Protection Act 2019 was enacted as the primary legislation governing data protection in Kenya. The Act regulates the collection, use and dissemination of personal data, outlines principles of data collection, the rights of data subjects and imposes obligations on data controllers and processors. The act also established the Office of the Data Protection Commissioner which ensures compliance with data protection laws.
To understand data protection, you need to identify and distinguish the following three parties:
Data Subject- An identified or identifiable natural person who is the subject of personal data. The person the data is about (the who).
Data Controller- A natural or legal person, public authority, agency or other body which alone, or jointly with others determines the purpose and means of processing personal data. The one deciding why and how the data is used (the why).
Data Processor- A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. The one actually handling or processing the data (the how).
The next key thing is to establish the role of the Geospatial Information which will differ according to the business model. Below are several scenarios that are likely to occur to geospatial information providers:
- A client (Third party) requires geospatial information. When issued with the ‘raw data’, the client adds information that renders it personal data or uses it to identify an individual. Example: A mapping data provider supplies raw geospatial data (like satellite imagery or topographic maps) to a private company. The client, a real estate agency, overlays property owner details and pricing information onto the map, making it personal data.
Legal Implication: The real estate agency becomes the data controller, while the GIP remains a neutral data provider with no direct privacy obligations.
- The geospatial information provider itself creates personal data. In this case, it becomes the data controller and may use it for its own purposes or sell it.
Example: A smart city initiative (e.g., a government GIS department) collects and processes real-time location data from surveillance cameras and public transport GPS systems. This data includes identifiable movement patterns of individuals, making it personal data.
Legal Implication: The GIP is the data controller and must comply with privacy laws. It must ensure data minimization, security, and lawful processing.
- The geospatial information provider is hired to perform services that entail the processing of personal data. They then become data processors.
Example: A logistics company hires a geospatial analytics firm to track delivery drivers in real time and analyze their routes for efficiency. The logistics company provides driver GPS data, which the analytics firm processes but does not control.
Legal Implication: The geospatial analytics firm is a data processor, meaning it must process data only as instructed by the logistics company (the data controller).
- The geospatial information provider collaborates with a 3rd party to create an application or offer a service through which data is processed. They become joint controllers.
Example: A fitness app company partners with a geospatial service provider to develop a running route recommendation feature based on users’ location data. Both companies decide why and how the geospatial data is processed.
Legal Implication: They are joint controllers, meaning both companies are responsible for ensuring privacy compliance, including obtaining user consent and providing transparency.
- The geospatial information provider supplies non-personal data. This is the ideal case as there are no legal obligations stemming from privacy and data protection.
Example: A weather service provider supplies satellite imagery and climate patterns without personal data. Businesses use this non-identifiable geospatial data for environmental studies, farming predictions, or disaster management.
Legal Implication: Since the data has no personal identifiers, there are no privacy-related obligations under data protection laws.
As a data controller or data processor, you have a legal obligation to observe the principles of data protection. This means that you should ensure that the personal data is:
- Processed in accordance with the right to privacy of the data subject
- Processed lawfully, fairly and in a transparent manner in relation to any data subject;
- Collected for explicit, specified and legitimate purposes and not further processed in a manner incompatible with those purposes;
- Adequate, relevant, limited to what is necessary in relation to the purposes for which it is processed;
- Collected only where a valid explanation is provided whenever information relating to family or private affairs is required;
- Accurate and, where necessary, kept up to date, with every reasonable step being taken to ensure that any inaccurate personal data is erased or rectified without delay;
- Kept in a form that identifies the data subjects for no longer than is necessary for the purposes for which it was collected; and
- Not transferred outside Kenya, unless there is proof of adequate data protection safeguards or consent from the data subject.
Innovation and privacy can indeed coexist, but only if each player is fully aware of their role and obligations—and diligently fulfills them. Without this, increasingly complex technology will only exacerbate data protection challenges, leading to a myriad of legal issues arising from potential data breaches.
